feat: security hardening, wechat pay v3 platform cert integration, companion certification revocation, and audit closed-loop

server/src/core/pay/wechat-pay-v3.ts

@@ -0,0 +1,215 @@
+// 已读取AGENTS.md
+/**
+ * 微信支付 V3 (微信支付APIv3) 直连商户服务端客户端
+ * - 使用商户 API 私钥 (apiclient_key.pem) 对请求做 RSA-SHA256 签名
+ * - 使用微信支付平台公钥/平台证书 对回调做验签
+ * - 使用 APIv3 密钥 对回调 resource 做 AES-256-GCM 解密
+ * 该模块为纯函数/无状态，便于离线单元校验与复用。
+ */
+import crypto from 'crypto';
+import https from 'https';
+
+export interface WechatPayConfig {
+  appId: string;
+  mchId: string;
+  apiV3Key: string;
+  serialNo: string;
+  privateKey: string;
+  platformPublicKey?: string;
+  platformPublicKeyId?: string;
+  notifyUrl?: string;
+}
+
+const WXPAY_HOST = 'api.mch.weixin.qq.com';
+
+/** 解析微信支付平台公钥：兼容「公钥 PEM」与「平台证书 PEM」两种输入 */
+export function resolvePlatformKey(platformKeyOrCert?: string): crypto.KeyObject | null {
+  const pem = String(platformKeyOrCert || '').trim();
+  if (!pem) return null;
+  try {
+    return crypto.createPublicKey(pem);
+  } catch (_) {
+    // 若为 X509 证书 PEM，则提取其中的公钥
+    try {
+      return new crypto.X509Certificate(pem).publicKey;
+    } catch (_e) {
+      return null;
+    }
+  }
+}
+
+/** 生成微信支付 V3 请求的 Authorization 头 */
+export function buildAuthorization(opts: {
+  method: string;
+  urlPath: string;
+  body: string;
+  cfg: WechatPayConfig;
+}): string {
+  const timestamp = String(Math.floor(Date.now() / 1000));
+  const nonceStr = crypto.randomBytes(16).toString('hex');
+  const message = `${opts.method}\n${opts.urlPath}\n${timestamp}\n${nonceStr}\n${opts.body}\n`;
+  const signature = crypto
+    .createSign('RSA-SHA256')
+    .update(message)
+    .sign(opts.cfg.privateKey, 'base64');
+  return (
+    `WECHATPAY2-SHA256-RSA2048 ` +
+    `mchid="${opts.cfg.mchId}",` +
+    `nonce_str="${nonceStr}",` +
+    `signature="${signature}",` +
+    `timestamp="${timestamp}",` +
+    `serial_no="${opts.cfg.serialNo}"`
+  );
+}
+
+/** 底层 HTTPS 请求，返回状态码 / 响应头 / 原始文本 */
+export function httpsRequest(opts: {
+  method: string;
+  urlPath: string;
+  headers: Record<string, string>;
+  body?: string;
+}): Promise<{ statusCode: number; headers: any; body: string }> {
+  return new Promise((resolve, reject) => {
+    const req = https.request(
+      {
+        method: opts.method,
+        hostname: WXPAY_HOST,
+        path: opts.urlPath,
+        headers: opts.headers,
+      },
+      (resp) => {
+        let data = '';
+        resp.on('data', (chunk) => {
+          data += chunk;
+        });
+        resp.on('end', () =>
+          resolve({ statusCode: resp.statusCode || 0, headers: resp.headers, body: data })
+        );
+      }
+    );
+    req.on('error', reject);
+    if (opts.body) req.write(opts.body);
+    req.end();
+  });
+}
+
+/** JSAPI 统一下单，返回 prepay_id（并为小程序返回支付参数） */
+export async function createJsapiPrepay(
+  cfg: WechatPayConfig,
+  params: { outTradeNo: string; description: string; amountTotalCents: number; openid: string }
+): Promise<string> {
+  const urlPath = '/v3/pay/transactions/jsapi';
+  const body = JSON.stringify({
+    appid: cfg.appId,
+    mchid: cfg.mchId,
+    description: params.description,
+    out_trade_no: params.outTradeNo,
+    notify_url: cfg.notifyUrl,
+    amount: { total: params.amountTotalCents, currency: 'CNY' },
+    payer: { openid: params.openid },
+  });
+  const authorization = buildAuthorization({ method: 'POST', urlPath, body, cfg });
+  const resp = await httpsRequest({
+    method: 'POST',
+    urlPath,
+    headers: {
+      'Content-Type': 'application/json',
+      Accept: 'application/json',
+      Authorization: authorization,
+      'User-Agent': 'peiwan-server/1.0',
+    },
+    body,
+  });
+  if (resp.statusCode >= 400) {
+    throw new Error(`微信支付 JSAPI 下单失败 [${resp.statusCode}]: ${resp.body}`);
+  }
+  const parsed = JSON.parse(resp.body || '{}');
+  if (!parsed.prepay_id) {
+    throw new Error(`微信支付未返回 prepay_id: ${resp.body}`);
+  }
+  return parsed.prepay_id as string;
+}
+
+/** 使用 prepay_id 生成小程序 wx.requestPayment 所需参数并签名 */
+export function buildJsapiPayParams(
+  cfg: WechatPayConfig,
+  prepayId: string
+): { timeStamp: string; nonceStr: string; package: string; signType: 'RSA'; paySign: string } {
+  const timeStamp = String(Math.floor(Date.now() / 1000));
+  const nonceStr = crypto.randomBytes(16).toString('hex');
+  const packageStr = `prepay_id=${prepayId}`;
+  const message = `${cfg.appId}\n${timeStamp}\n${nonceStr}\n${packageStr}\n`;
+  const paySign = crypto
+    .createSign('RSA-SHA256')
+    .update(message)
+    .sign(cfg.privateKey, 'base64');
+  return { timeStamp, nonceStr, package: packageStr, signType: 'RSA', paySign };
+}
+
+/** 主动查单（用于支付成功后及时对账，避免仅依赖异步回调） */
+export async function queryOrderByOutTradeNo(
+  cfg: WechatPayConfig,
+  outTradeNo: string
+): Promise<any> {
+  const urlPath = `/v3/pay/transactions/out-trade-no/${encodeURIComponent(outTradeNo)}?mchid=${encodeURIComponent(cfg.mchId)}`;
+  const authorization = buildAuthorization({ method: 'GET', urlPath, body: '', cfg });
+  const resp = await httpsRequest({
+    method: 'GET',
+    urlPath,
+    headers: {
+      Accept: 'application/json',
+      Authorization: authorization,
+      'User-Agent': 'peiwan-server/1.0',
+    },
+  });
+  if (resp.statusCode >= 400) {
+    throw new Error(`微信支付查单失败 [${resp.statusCode}]: ${resp.body}`);
+  }
+  return JSON.parse(resp.body || '{}');
+}
+
+/** 校验微信支付回调签名（使用平台公钥/平台证书），时间戳容差 5 分钟 */
+export function verifyNotifySignature(params: {
+  cfg: WechatPayConfig;
+  timestamp: string;
+  nonce: string;
+  body: string;
+  signature: string;
+  serial: string;
+}): boolean {
+  const { cfg, timestamp, nonce, body, signature } = params;
+  if (!timestamp || !nonce || !signature) return false;
+  const platformKey = resolvePlatformKey(cfg.platformPublicKey);
+  if (!platformKey) return false;
+  if (Math.abs(Date.now() / 1000 - Number(timestamp)) > 300) return false;
+  const message = `${timestamp}\n${nonce}\n${body}\n`;
+  try {
+    return crypto
+      .createVerify('RSA-SHA256')
+      .update(message)
+      .verify(platformKey, signature, 'base64');
+  } catch (_) {
+    return false;
+  }
+}
+
+/** 解密回调 resource（AES-256-GCM，key 为 32 位 APIv3 密钥） */
+export function decryptNotifyResource(
+  apiV3Key: string,
+  resource: { ciphertext: string; nonce: string; associated_data?: string }
+): any {
+  const key = Buffer.from(String(apiV3Key), 'utf8');
+  if (key.length !== 32) {
+    throw new Error('APIv3 密钥长度必须为 32 位');
+  }
+  const data = Buffer.from(resource.ciphertext, 'base64');
+  const authTag = data.subarray(data.length - 16);
+  const ciphertext = data.subarray(0, data.length - 16);
+  const decipher = crypto.createDecipheriv('aes-256-gcm', key, Buffer.from(resource.nonce, 'utf8'));
+  decipher.setAuthTag(authTag);
+  if (resource.associated_data) {
+    decipher.setAAD(Buffer.from(resource.associated_data, 'utf8'));
+  }
+  const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return JSON.parse(decrypted.toString('utf8'));
+}

server/src/core/security/content-security.service.ts

@@ -13,6 +13,16 @@ export interface SecurityCheckResult {
   message: string;
 }
 
+/**
+ * 远端内容安全检测器签名（由服务端启动时注入真实的微信 msgSecCheck 调用）。
+ * 返回 null 表示远端不可用/未配置，调用方应降级为本地词库结果。
+ */
+export type RemoteTextChecker = (
+  text: string,
+  openid?: string,
+  scene?: number
+) => Promise<SecurityCheckResult | null>;
+
 export class ContentSecurityService {
   // 敏感词黑名单库（按涉黄低俗、涉政暴恐、欺诈引流、违规黑产分类）
   private static readonly SENSITIVE_KEYWORDS: { [category: string]: string[] } = {
@@ -33,6 +43,20 @@ export class ContentSecurityService {
   // 动态自定义敏感词列表（支持管理后台增删改并实时热生效）
   private customKeywords: string[] = [];
 
+  // 远端真实审核器（微信官方 security.msgSecCheck），未注入时仅使用本地词库
+  private remoteChecker?: RemoteTextChecker;
+
+  /**
+   * 注入/替换远端真实内容安全审核器（微信 msgSecCheck）
+   */
+  public setRemoteChecker(checker: RemoteTextChecker): void {
+    this.remoteChecker = checker;
+  }
+
+  public hasRemoteChecker(): boolean {
+    return typeof this.remoteChecker === 'function';
+  }
+
   /**
    * 载入或更新动态敏感词黑名单
    */
@@ -49,6 +73,27 @@ export class ContentSecurityService {
     return [...this.customKeywords];
   }
 
+  /**
+   * 异步内容安全检测（真实对接微信 security.msgSecCheck）
+   * 双层防御：先跑本地词库即时拦截；本地放行且已注入远端审核器时，
+   * 再调用微信官方机器审核。远端异常/未配置时降级为本地结果（fail-open），避免阻断正常业务。
+   * @param text 待检测文本
+   * @param openid 用户微信 openid（供微信官方溯源，强烈建议传入）
+   * @param scene 场景值：1 资料；2 评论；3 论坛；4 社交日志
+   */
+  public async checkTextAsync(text: string, openid?: string, scene?: number): Promise<SecurityCheckResult> {
+    const local = this.checkText(text, openid);
+    if (!local.pass) return local;
+    if (typeof this.remoteChecker !== 'function') return local;
+    try {
+      const remote = await this.remoteChecker(text, openid, scene);
+      if (remote) return remote;
+    } catch (_) {
+      // 远端异常时降级为本地词库结果
+    }
+    return local;
+  }
+
   /**
    * 检查文本内容安全 (security.msgSecCheck)
    * @param text 待检测文本（支持动态、评论、活动标题、个人简介等）

server/src/core/security/user-token.ts

@@ -0,0 +1,54 @@
+import * as crypto from 'crypto';
+
+/**
+ * 小程序用户会话 token（HMAC-SHA256 签名，无状态）。
+ * 目的是让服务端在资金/敏感写接口上以「服务端签发并验签的身份」为准，
+ * 杜绝客户端通过伪造 userId 冒充他人。
+ *
+ * token 结构： base64url(JSON{uid,ts}) + "." + base64url(HMAC_SHA256(payload, secret))
+ */
+
+function base64url(input: Buffer | string): string {
+  return Buffer.from(input).toString('base64url');
+}
+
+export function signUserToken(
+  userId: number,
+  secret: string,
+  ttlMs: number,
+  now: number = Date.now()
+): string {
+  const payload = base64url(JSON.stringify({ uid: Number(userId), ts: Number(now) }));
+  const sig = crypto.createHmac('sha256', secret).update(payload).digest('base64url');
+  return `${payload}.${sig}`;
+}
+
+export function verifyUserToken(
+  token: string,
+  secret: string,
+  ttlMs: number,
+  now: number = Date.now()
+): number | null {
+  const parts = String(token || '').split('.');
+  if (parts.length !== 2) return null;
+  const [payload, sig] = parts;
+  if (!payload || !sig) return null;
+
+  const expected = crypto.createHmac('sha256', secret).update(payload).digest('base64url');
+  const sigBuf = Buffer.from(sig);
+  const expBuf = Buffer.from(expected);
+  if (sigBuf.length !== expBuf.length || !crypto.timingSafeEqual(sigBuf, expBuf)) return null;
+
+  try {
+    const data = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));
+    const uid = Number(data.uid);
+    const ts = Number(data.ts);
+    if (!uid || !ts) return null;
+    if (now - ts > ttlMs) return null;
+    // 拒绝明显来自未来（时钟漂移/伪造）的 token
+    if (ts - now > 5 * 60 * 1000) return null;
+    return uid;
+  } catch (_) {
+    return null;
+  }
+}

server/src/db/mysql.ts

@@ -27,6 +27,7 @@ export async function initDatabase(): Promise<void> {
         title VARCHAR(255) NOT NULL,
         game_category VARCHAR(64) NOT NULL,
         location VARCHAR(255),
+        start_time VARCHAR(64) DEFAULT '',
         pay_type INT NOT NULL DEFAULT 1,
         total_fee_cents INT DEFAULT 0,
         per_person_fee_cents INT DEFAULT 0,
@@ -38,6 +39,12 @@ export async function initDatabase(): Promise<void> {
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
     `);
 
+    try {
+      await conn.query(`ALTER TABLE activities ADD COLUMN start_time VARCHAR(64) DEFAULT '' AFTER location`);
+    } catch (_) {
+      // 字段已存在忽略
+    }
+
     try {
       await conn.query(`ALTER TABLE activities ADD COLUMN status VARCHAR(32) DEFAULT 'RECRUITING' AFTER price_adjust_rule`);
     } catch (_) {
@@ -57,10 +64,24 @@ export async function initDatabase(): Promise<void> {
         verified_by INT NULL,
         created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
         INDEX idx_activity (activity_id),
-        INDEX idx_verify_code (verify_code)
+        INDEX idx_verify_code (verify_code),
+        UNIQUE KEY uq_activity_user (activity_id, user_id),
+        UNIQUE KEY uq_activity_verify (activity_id, verify_code)
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
     `);
 
+    // 历史库补丁：为已存在的 participants 表补充唯一约束（防重复报名 / 防核销码冲突）
+    for (const uqSql of [
+      'ALTER TABLE participants ADD UNIQUE KEY uq_activity_user (activity_id, user_id)',
+      'ALTER TABLE participants ADD UNIQUE KEY uq_activity_verify (activity_id, verify_code)'
+    ]) {
+      try {
+        await conn.query(uqSql);
+      } catch (_) {
+        // 约束已存在或历史数据存在重复，忽略（应用层仍会二次校验）
+      }
+    }
+
     // 3. 陪玩大神档案表
     await conn.query(`
       CREATE TABLE IF NOT EXISTS companions (
@@ -131,7 +152,9 @@ export async function initDatabase(): Promise<void> {
       "ALTER TABLE orders ADD COLUMN coupon_discount DECIMAL(10,2) DEFAULT 0.00 AFTER amount",
       "ALTER TABLE orders ADD COLUMN paid_at DATETIME NULL AFTER created_at",
       "ALTER TABLE orders ADD COLUMN finish_applied_at DATETIME NULL AFTER paid_at",
-      "ALTER TABLE orders ADD COLUMN refund_amount DECIMAL(10,2) DEFAULT 0.00 AFTER coupon_discount"
+      "ALTER TABLE orders ADD COLUMN refund_amount DECIMAL(10,2) DEFAULT 0.00 AFTER coupon_discount",
+      "ALTER TABLE orders ADD COLUMN claimed_by INT NULL AFTER expert_id",
+      "ALTER TABLE orders ADD COLUMN claimed_at DATETIME NULL AFTER claimed_by"
     ];
     for (const colSql of extraOrderCols) {
       try {
@@ -194,6 +217,26 @@ export async function initDatabase(): Promise<void> {
       await conn.query('ALTER TABLE withdrawals ADD COLUMN reason VARCHAR(255) DEFAULT ""');
     } catch (_) {}
 
+    // 7.5 微信支付支付意图与对账表 (幂等入账的唯一依据)
+    await conn.query(`
+      CREATE TABLE IF NOT EXISTS payment_intents (
+        id VARCHAR(64) PRIMARY KEY,
+        out_trade_no VARCHAR(64) UNIQUE NOT NULL,
+        scene VARCHAR(32) NOT NULL DEFAULT 'ORDER',
+        user_id INT NOT NULL DEFAULT 0,
+        order_id VARCHAR(64) DEFAULT '',
+        title VARCHAR(128) DEFAULT '',
+        amount_cents INT NOT NULL DEFAULT 0,
+        bonus_cents INT NOT NULL DEFAULT 0,
+        status VARCHAR(32) NOT NULL DEFAULT 'PENDING',
+        transaction_id VARCHAR(64) DEFAULT '',
+        credited TINYINT NOT NULL DEFAULT 0,
+        created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
+        paid_at DATETIME NULL,
+        INDEX idx_user_scene (user_id, scene, status)
+      ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+    `);
+
     // 8. 线下合规场所库
     await conn.query(`
       CREATE TABLE IF NOT EXISTS safety_places (
@@ -292,10 +335,18 @@ export async function initDatabase(): Promise<void> {
         reply_time DATETIME,
         created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
         INDEX idx_order (order_id),
-        INDEX idx_expert (expert_id)
+        INDEX idx_expert (expert_id),
+        UNIQUE KEY uq_order_review (order_id)
       ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
     `);
 
+    // 历史库补丁：同一订单仅允许一条评价，防止重复评价反复触发结算
+    try {
+      await conn.query('ALTER TABLE order_reviews ADD UNIQUE KEY uq_order_review (order_id)');
+    } catch (_) {
+      // 约束已存在或历史数据存在重复，忽略（应用层仍会二次校验）
+    }
+
     try {
       await conn.query('ALTER TABLE order_reviews ADD COLUMN reply_content TEXT AFTER content');
     } catch (_) {}
@@ -895,6 +946,32 @@ async function seedInitialDataIfEmpty(conn: any): Promise<void> {
     remark: '微信小程序订阅消息与服务通知模版ID配置'
   });
 
+  const wechatPayConfigVal = JSON.stringify({
+    mode: 'AUTO',
+    appId: 'wx0c929f7e54024e67',
+    appSecret: '63a412f3f73af8e73f6923943bf9683c',
+    mchId: '',
+    apiV3Key: '',
+    serialNo: '',
+    privateKey: '',
+    certPem: '',
+    platformPublicKeyId: '',
+    platformPublicKey: '',
+    notifyUrl: 'https://peiww.gynhc.com/api/pay/wechat/notify',
+    remark: '微信支付V3直连商户参数配置（配置完整后自动或手动切换至实盘JSAPI支付）'
+  });
+
+  const mapLocationConfigVal = JSON.stringify({
+    provider: 'tencent',
+    mapKey: '',
+    secretKey: '',
+    serviceName: '腾讯位置服务 (Tencent LBS)',
+    enableChooseLocation: 1,
+    enableDistanceCalculation: 1,
+    defaultCity: '北京市',
+    remark: '腾讯位置服务 Key（需在 lbs.qq.com 申请并勾选 WebServiceAPI 与微信小程序 AppID: wx0c929f7e54024e67）'
+  });
+
   const [cfgItemRows]: any = await conn.query('SELECT COUNT(*) as count FROM platform_configs');
   if (cfgItemRows[0].count === 0) {
     const customerServiceVal = JSON.stringify({
@@ -938,12 +1015,16 @@ async function seedInitialDataIfEmpty(conn: any): Promise<void> {
       ('home_popup', '小程序首页运营全局弹窗', ?, '节日活动推广、新用户专享首单优惠全局浮层弹窗', 1),
       ('expert_rules', '大神技能标签库与定价区间规范', ?, '陪玩大神入驻审核、定价上下限限制与官方推荐技能标签库', 1),
       ('finance_rules', '平台抽成与推广分销规则', ?, '平台佣金抽成比例、二级分销返润与佣金提现门槛限制', 1),
-      ('activity_rules', '同城组局发单与预算预设规范', ?, '招募席位上下限、快捷单人赏金预设与包场预算梯队', 1);
+      ('activity_rules', '同城组局发单与预算预设规范', ?, '招募席位上下限、快捷单人赏金预设与包场预算梯队', 1),
+      ('message_template_rules', '微信服务通知与模板消息配置', ?, '微信订阅消息通知与状态模板配置', 1),
+      ('wechat_pay_config', '微信支付商户号与证书配置', ?, '微信支付V3商户号、APIv3密钥与证书参数配置', 1),
+      ('map_location_config', '地图定位与LBS服务配置', ?, '腾讯位置服务Key、选点与周边测距参数配置', 1);
     `, [
       customerServiceVal, safetyNoticeVal, protocolVal,
       communityTopicsVal, communityNoticeVal, faqListVal,
       securityWordsVal, homePopupVal, expertRulesVal,
-      financeRulesVal, activityRulesVal
+      financeRulesVal, activityRulesVal, messageTemplateRulesVal,
+      wechatPayConfigVal, mapLocationConfigVal
     ]);
   } else {
     // 增量保证各核心配置项完整就绪
@@ -1003,6 +1084,40 @@ async function seedInitialDataIfEmpty(conn: any): Promise<void> {
         VALUES ('message_template_rules', '微信服务通知与模板消息配置', ?, '微信订阅消息通知与状态模板配置', 1)
       `, [messageTemplateRulesVal]);
     }
+    if (!existingKeys.has('wechat_pay_config')) {
+      await conn.query(`
+        INSERT INTO platform_configs (config_key, name, value_json, description, status)
+        VALUES ('wechat_pay_config', '微信支付商户号与证书配置', ?, '微信支付V3商户号、APIv3密钥与证书参数配置', 1)
+      `, [wechatPayConfigVal]);
+    } else {
+      const [wpRows]: any = await conn.query("SELECT value_json FROM platform_configs WHERE config_key = 'wechat_pay_config'");
+      if (wpRows && wpRows.length > 0) {
+        let curVal = wpRows[0].value_json;
+        if (typeof curVal === 'string') {
+          try { curVal = JSON.parse(curVal); } catch (_) {}
+        }
+        if (curVal && typeof curVal === 'object') {
+          let updated = false;
+          if (!curVal.appId || curVal.appId === 'wx_peiwan_miniapp') {
+            curVal.appId = 'wx0c929f7e54024e67';
+            updated = true;
+          }
+          if (!curVal.appSecret) {
+            curVal.appSecret = '63a412f3f73af8e73f6923943bf9683c';
+            updated = true;
+          }
+          if (updated) {
+            await conn.query("UPDATE platform_configs SET value_json = ? WHERE config_key = 'wechat_pay_config'", [JSON.stringify(curVal)]);
+          }
+        }
+      }
+    }
+    if (!existingKeys.has('map_location_config')) {
+      await conn.query(`
+        INSERT INTO platform_configs (config_key, name, value_json, description, status)
+        VALUES ('map_location_config', '地图定位与LBS服务配置', ?, '腾讯位置服务Key、选点与周边测距参数配置', 1)
+      `, [mapLocationConfigVal]);
+    }
     if (existingKeys.has('platform_protocol')) {
       const [protoRows]: any = await conn.query("SELECT value_json FROM platform_configs WHERE config_key = 'platform_protocol'");
       if (protoRows && protoRows.length > 0) {

server/tests/admin-features.spec.ts

@@ -12,6 +12,7 @@ describe('PC总后台管理端核心业务与闭环能力自动化测试 (Post M
   const adminFinanceWithdrawVuePath = path.join(rootDir, 'admin/arco-design-pro-vite/src/views/finance/withdraw/index.vue');
   const adminPlatformConfigVuePath = path.join(rootDir, 'admin/arco-design-pro-vite/src/views/safety/platform-config/index.vue');
   const adminCommunityRouterPath = path.join(rootDir, 'admin/arco-design-pro-vite/src/router/routes/modules/community.ts');
+  const adminUserListVuePath = path.join(rootDir, 'admin/arco-design-pro-vite/src/views/user/list/index.vue');
 
   describe('1. 友圈广场动态管理与置顶/状态流转/级联删除闭环验证', () => {
     it('数据库层必须扩展 posts 表结构并包含 is_top 与 status 字段', () => {
@@ -118,14 +119,91 @@ describe('PC总后台管理端核心业务与闭环能力自动化测试 (Post M
     });
   });
 
-  describe('4. 全流程无 Emoji 门禁合规校验', () => {
+  describe('4. 全平台用户列表删除与批量删除闭环校验', () => {
+    it('数据仓储层 MysqlRepository 必须实现 deleteUser 与 deleteUsers 方法', () => {
+      const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(repoCode).toContain('async deleteUser(id: number): Promise<boolean>');
+      expect(repoCode).toContain('async deleteUsers(ids: number[]): Promise<number>');
+      expect(repoCode).toContain('DELETE FROM users WHERE id = ?');
+      expect(repoCode).toContain('DELETE FROM users WHERE id IN');
+    });
+
+    it('后端服务 index.ts 必须注册单个删除与批量删除 API 路由', () => {
+      const serverCode = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(serverCode).toContain("app.delete('/api/users/:id'");
+      expect(serverCode).toContain("app.post('/api/users/batch-delete'");
+      expect(serverCode).toContain('repo.deleteUser(');
+      expect(serverCode).toContain('repo.deleteUsers(');
+    });
+
+    it('用户列表前端视图 user/list/index.vue 必须包含行级删除与批量删除按钮及确认弹窗', () => {
+      const userListCode = fs.readFileSync(adminUserListVuePath, 'utf-8');
+      expect(userListCode).toContain('handleDeleteUser');
+      expect(userListCode).toContain('handleBatchDelete');
+      expect(userListCode).toContain('selectedRowKeys');
+      expect(userListCode).toContain('icon-delete');
+      expect(userListCode).toContain('a-popconfirm');
+      expect(userListCode).toContain('/api/users/batch-delete');
+      expect(userListCode).toContain('/api/users/${record.id}');
+    });
+  });
+
+  describe('5. 大神认证资质解除与接单状态持久化闭环校验', () => {
+    const adminCompanionListVuePath = path.join(rootDir, 'admin/arco-design-pro-vite/src/views/companion/list/index.vue');
+    const adminCompanionAuditVuePath = path.join(rootDir, 'admin/arco-design-pro-vite/src/views/companion/audit/index.vue');
+    const uniApiJsPath = path.join(rootDir, 'pwuniapp/common/api.js');
+
+    it('仓储层 auditCompanion 必须支持 revoke 解除认证动作并联动回退用户角色与双身份标识', () => {
+      const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(repoCode).toContain("action: 'approve' | 'reject' | 'revoke'");
+      expect(repoCode).toContain('已解除大神认证资质');
+      expect(repoCode).toContain('const isCertExpert = companionRow ? certStatus === 2 : (certStatus === 2 || roleHasExpert)');
+    });
+
+    it('管理后台大神档案库必须支持解除认证弹窗与接单状态真实持久化', () => {
+      const listCode = fs.readFileSync(adminCompanionListVuePath, 'utf-8');
+      expect(listCode).toContain('解除认证');
+      expect(listCode).toContain('openRevokeModal');
+      expect(listCode).toContain('handleRevokeSubmit');
+      expect(listCode).toContain("action: 'revoke'");
+      expect(listCode).toContain('axios.put(`/api/companions/${record.id}`');
+    });
+
+    it('管理后台入驻资质审核页必须支持对已通过大神解除认证及对已驳回记录恢复认证', () => {
+      const auditCode = fs.readFileSync(adminCompanionAuditVuePath, 'utf-8');
+      expect(auditCode).toContain('解除认证');
+      expect(auditCode).toContain('恢复认证');
+      expect(auditCode).toContain("openRejectModal(record, 'revoke')");
+    });
+
+    it('小程序端获取同城大神列表必须过滤未通过或已解除认证的记录', () => {
+      const apiCode = fs.readFileSync(uniApiJsPath, 'utf-8');
+      expect(apiCode).toContain("c.auditStatus === '已通过'");
+    });
+
+    it('微信支付配置必须支持微信支付平台公钥上传与商户证书序列号自动提取', () => {
+      const configViewCode = fs.readFileSync(adminPlatformConfigVuePath, 'utf-8');
+      const serverCode = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(configViewCode).toContain('platformPublicKeyId');
+      expect(configViewCode).toContain('platformPublicKey');
+      expect(configViewCode).toContain("triggerPemSelect('platformPublicKey')");
+      expect(configViewCode).toContain('extractCertSerialNo');
+      expect(serverCode).toContain("app.post('/api/admin/pay/wechat/parse-cert'");
+      expect(serverCode).toContain('extractSerialNoFromCertPem');
+    });
+  });
+
+  describe('6. 全流程无 Emoji 门禁合规校验', () => {
     it('新增的前后端代码中严禁包含任何系统 Emoji 图标字符', () => {
       const filesToCheck = [
         adminCommunityRouterPath,
         adminPostManageVuePath,
         adminFinanceRecordsVuePath,
         adminFinanceWithdrawVuePath,
-        adminPlatformConfigVuePath
+        adminPlatformConfigVuePath,
+        adminUserListVuePath,
+        path.join(rootDir, 'admin/arco-design-pro-vite/src/views/companion/list/index.vue'),
+        path.join(rootDir, 'admin/arco-design-pro-vite/src/views/companion/audit/index.vue')
       ];
 
       const emojiRegex = /[\uD83C-\uDBFF\uDC00-\uDFFF\u2600-\u26FF\u2700-\u27BF]/;

server/tests/admin-observability.spec.ts

@@ -0,0 +1,69 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第八批回归闸门：后台"静默兜底"数据盲区
+ * 接口失败时不得再以伪造/默认/归零数据伪装成功，必须显式暴露失败状态。
+ */
+describe('第八批后台可观测性闸门 (静默兜底数据盲区)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const adminSrc = path.join(rootDir, 'admin/arco-design-pro-vite/src/views');
+  const read = (rel: string) => fs.readFileSync(path.join(adminSrc, rel), 'utf-8');
+
+  const financeConfig = read('finance/config/index.vue');
+  const dataPanel = read('dashboard/workplace/components/data-panel.vue');
+  const actionHub = read('dashboard/workplace/components/action-hub.vue');
+  const quickTodo = read('dashboard/workplace/components/quick-todo-list.vue');
+  const quickVerifier = read('dashboard/workplace/components/quick-verifier.vue');
+
+  describe('1. 财务/微信支付配置：读取失败不得用默认值覆盖线上', () => {
+    it('维护 configLoaded / wxPayLoaded 加载状态', () => {
+      expect(financeConfig).toContain('const configLoaded = ref(false)');
+      expect(financeConfig).toContain('const wxPayLoaded = ref(false)');
+    });
+
+    it('读取失败必须锁定保存按钮', () => {
+      expect(financeConfig).toContain(':disabled="!configLoaded"');
+      expect(financeConfig).toContain(':disabled="!wxPayLoaded"');
+    });
+
+    it('读取失败必须提示并阻止保存覆盖', () => {
+      expect(financeConfig).toContain('避免以默认值覆盖线上配置');
+      expect(financeConfig).toContain('避免清空线上商户参数');
+      expect(financeConfig).not.toContain('// 保持兜底');
+      expect(financeConfig).not.toContain('// 保持默认');
+    });
+  });
+
+  describe('2. 经营指标：不得展示伪造数字', () => {
+    it('移除硬编码伪造经营数据并暴露失败状态', () => {
+      expect(dataPanel).toContain('const loadFailed = ref(false)');
+      expect(dataPanel).not.toContain('58920');
+      expect(dataPanel).not.toContain('1250');
+      expect(dataPanel).toContain('核心经营指标加载失败');
+    });
+  });
+
+  describe('3. 待办中心：不得静默归零', () => {
+    it('实时待办暴露失败状态', () => {
+      expect(actionHub).toContain('const loadFailed = ref(false)');
+      expect(actionHub).not.toContain('pendingAuditsCount: 2');
+      expect(actionHub).toContain('待办数据加载失败');
+    });
+
+    it('重点待办列表暴露失败状态', () => {
+      expect(quickTodo).toContain('const loadFailed = ref(false)');
+      expect(quickTodo).toContain('重点待办加载失败');
+      expect(quickTodo).not.toContain('// 保持兜底');
+    });
+  });
+
+  describe('4. 现场核销：活动列表失败必须提示', () => {
+    it('核销活动列表暴露失败状态', () => {
+      expect(quickVerifier).toContain('const activitiesFailed = ref(false)');
+      expect(quickVerifier).toContain('组局活动列表加载失败');
+      expect(quickVerifier).not.toContain('// 保持兜底');
+    });
+  });
+});

server/tests/client-features.spec.ts

@@ -159,6 +159,24 @@ describe('ClientFeatures (TDD 测试套件: 用户端功能闭环)', () => {
       expect(content).toContain('signature');
       expect(content).toContain('contentSecurityService.checkText');
     });
+
+    it('后端 index.ts POST /api/users/:id/profile 必须校验手机号与微信号格式并拦截非法输入', () => {
+      const indexPath = path.join(serverSrcDir, 'index.ts');
+      const content = fs.readFileSync(indexPath, 'utf-8');
+
+      expect(content).toContain('1[3-9]');
+      expect(content).toContain('a-zA-Z');
+      expect(content).toContain('联系方式格式不正确');
+    });
+
+    it('前端 user/index.vue 必须集成联系方式格式校验与非法标点过滤', () => {
+      const userVuePath = path.join(uniPagesDir, 'user', 'index.vue');
+      const content = fs.readFileSync(userVuePath, 'utf-8');
+
+      expect(content).toContain('validateContact');
+      expect(content).toContain('onPhoneInput');
+      expect(content).toContain('field-label-row');
+    });
   });
 
   describe('4. 前端核心页面规范与结构完整性校验', () => {
@@ -488,8 +506,26 @@ describe('ClientFeatures (TDD 测试套件: 用户端功能闭环)', () => {
       const indexContent = fs.readFileSync(indexVuePath, 'utf-8');
       expect(indexContent).toContain('PENDING_INVITER_CODE');
     });
+
+    it('3.4 已封禁用户核心业务防线：后端仓储与路由必须全面拦截发单、报名、下单与动态评论', () => {
+      const serverIndexPath = path.join(serverSrcDir, 'index.ts');
+      const indexContent = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(indexContent).toContain('assertUserNotBanned');
+      expect(indexContent).toContain('您的账号已被管理员封禁');
+
+      const repoPath = path.join(serverSrcDir, 'db', 'repository.ts');
+      const repoContent = fs.readFileSync(repoPath, 'utf-8');
+      expect(repoContent).toContain("WHERE (u.status IS NULL OR u.status != '已封禁')");
+      expect(repoContent).toContain("UPDATE activities SET status = 'CANCELLED' WHERE creator_id = ? AND status = 'RECRUITING'");
+
+      const rolePath = path.join(rootDir, 'pwuniapp', 'common', 'role.js');
+      const roleContent = fs.readFileSync(rolePath, 'utf-8');
+      expect(roleContent).toContain('isUserBanned');
+      expect(roleContent).toContain("uInfo.status === '已封禁'");
+    });
   });
 });
 
 
 
+

server/tests/content-security.spec.ts

@@ -130,7 +130,7 @@ describe('ContentSecurityService & Compliance Architecture (TDD 微信内容安
       const raw = fs.readFileSync(pagesJsonPath, 'utf-8');
       const config = JSON.parse(raw);
       expect(Array.isArray(config.pages)).toBe(true);
-      expect(config.pages.length).toBe(22);
+      expect(config.pages.length).toBe(25);
 
       for (const pageItem of config.pages) {
         const vueFilePath = path.join(rootDir, 'pwuniapp', `${pageItem.path}.vue`);
@@ -1119,6 +1119,120 @@ describe('ContentSecurityService & Compliance Architecture (TDD 微信内容安
       expect(emojiRegex.test(fs.readFileSync(apiPath, 'utf-8'))).toBe(false);
     });
   });
+
+  describe('24. 独立专属钱包充值页面规格验证 (pages/user/recharge.vue)', () => {
+    const rechargePath = path.join(rootDir, 'pwuniapp', 'pages', 'user', 'recharge.vue');
+    const pagesJsonPath = path.join(rootDir, 'pwuniapp', 'pages.json');
+    const userIndexPath = path.join(rootDir, 'pwuniapp', 'pages', 'user', 'index.vue');
+
+    it('pages.json 必须成功注册 pages/user/recharge 且物理文件必须存在', () => {
+      expect(fs.existsSync(rechargePath)).toBe(true);
+      const pagesJson = JSON.parse(fs.readFileSync(pagesJsonPath, 'utf-8'));
+      const hasPage = pagesJson.pages.some((p: any) => p.path === 'pages/user/recharge');
+      expect(hasPage).toBe(true);
+    });
+
+    it('充值页面必须包含沉浸式导航栏、当前余额看板、档位网格、自定义金额、微信支付通道与提交栏', () => {
+      const content = fs.readFileSync(rechargePath, 'utf-8');
+      expect(content).toContain('custom-nav-bar');
+      expect(content).toContain('钱包充值');
+      expect(content).toContain('handleBack');
+      expect(content).toContain('balance-card');
+      expect(content).toContain('tier-grid');
+      expect(content).toContain('custom-amount');
+      expect(content).toContain('channel-card');
+      expect(content).toContain('微信支付');
+      expect(content).toContain('fixed-submit-bar');
+      expect(content).toContain('rechargeBalance');
+    });
+
+    it('个人中心页面 (pages/user/index.vue) 充值入口必须原生跳转至 /pages/user/recharge 且杜绝弹窗', () => {
+      const content = fs.readFileSync(userIndexPath, 'utf-8');
+      expect(content).toContain("url: '/pages/user/recharge'");
+      const rechargeFuncMatch = content.match(/const handleRecharge\s*=\s*(?:async\s*)?\(\)\s*=>\s*\{[\s\S]*?\n\};/);
+      expect(rechargeFuncMatch).not.toBeNull();
+      expect(rechargeFuncMatch![0]).toContain("url: '/pages/user/recharge'");
+      expect(rechargeFuncMatch![0]).not.toContain('showActionSheet');
+    });
+
+    it('充值页面与测试代码严禁包含任何系统 Emoji 与 showModal 4 字门禁违规', () => {
+      const rechargeContent = fs.readFileSync(rechargePath, 'utf-8');
+      const emojiRegex = /(?:\p{Extended_Pictographic}|\p{Emoji_Presentation}|[\u2600-\u27BF])/u;
+      expect(emojiRegex.test(rechargeContent)).toBe(false);
+
+      const modalMatches = rechargeContent.match(/(?:confirmText|cancelText)\s*:\s*['"]([^'"]+)['"]/g) || [];
+      for (const m of modalMatches) {
+        const text = m.split(':')[1].replace(/['"\s]/g, '');
+        expect(text.length).toBeLessThanOrEqual(4);
+      }
+    });
+  });
+
+  describe('25. 接单大厅大神本人信息与状态动态联动验证 (pages/expert/hall.vue)', () => {
+    const hallPath = path.join(rootDir, 'pwuniapp', 'pages', 'expert', 'hall.vue');
+
+    it('hall.vue 必须物理存在且支持从 Storage 动态加载当前登录大神的真实信息', () => {
+      expect(fs.existsSync(hallPath)).toBe(true);
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      expect(content).toContain("uni.getStorageSync('userId')");
+      expect(content).toContain("getUserProfile");
+      expect(content).toContain("getExpertStats");
+    });
+
+    it('hall.vue 必须在 onShow 中刷新当前登录大神的资料与接单在线状态', () => {
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      expect(content).toContain("EXPERT_RECEIVING_STATUS");
+      expect(content).toContain("onShow");
+      expect(content).toContain("loadHallData");
+    });
+
+    it('立即接单 handleGrabOrder 必须动态绑定当前大神的真实 ID、昵称与头像', () => {
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      expect(content).toContain("expert.value.id");
+      expect(content).toContain("expert.value.nickname");
+      expect(content).toContain("expert.value.avatar");
+      expect(content).not.toContain("companionName: '我 (接单大神)'");
+    });
+
+    it('hall.vue 页面代码与测试严禁包含任何系统 Emoji 与 showModal 4 字门禁违规', () => {
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      const emojiRegex = /(?:\p{Extended_Pictographic}|\p{Emoji_Presentation}|[\u2600-\u27BF])/u;
+      expect(emojiRegex.test(content)).toBe(false);
+
+      const modalMatches = content.match(/(?:confirmText|cancelText)\s*:\s*['"]([^'"]+)['"]/g) || [];
+      for (const m of modalMatches) {
+        const text = m.split(':')[1].replace(/['"\s]/g, '');
+        expect(text.length).toBeLessThanOrEqual(4);
+      }
+    });
+
+    it('派单卡片必须支持点击查看详情面板，且详情面板严禁使用 @click.self 必须 stopPropagation', () => {
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      expect(content).toContain('openOrderDetailModal');
+      expect(content).toContain('showDetailModal');
+      expect(content).toContain('dispatch-detail-mask');
+      expect(content).toContain('dispatch-detail-modal');
+      expect(content).toContain('closeOrderDetailModal');
+      expect(content).toContain('stopPropagation');
+      expect(content).not.toContain('@click.self');
+    });
+
+    it('派单详情弹窗酬金展示必须使用徽章卡片结构并实现货币符号与数字基线横排对齐', () => {
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      expect(content).toContain('reward-badge-card');
+      expect(content).toContain('badge-label');
+      expect(content).toContain('amount-row');
+      expect(content).toContain('curr-mark');
+      expect(content).toContain('reward-num');
+    });
+
+    it('派单详情弹窗单号必须支持脱敏简化展示并支持点击一键复制完整流水号', () => {
+      const content = fs.readFileSync(hallPath, 'utf-8');
+      expect(content).toContain('formatShortOrderNo');
+      expect(content).toContain('copyOrderNo');
+      expect(content).toContain('uni.setClipboardData');
+    });
+  });
 });
 
 

server/tests/dashboard-reality.spec.ts

@@ -0,0 +1,49 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第九批回归闸门：后台经营看板真实数据化
+ * 禁止服务端返回硬编码假经营数据，前后端均不得再以假走势兜底。
+ */
+describe('第九批看板真实数据闸门 (禁止硬编码经营指标)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const repoCode = fs.readFileSync(path.join(rootDir, 'server/src/db/repository.ts'), 'utf-8');
+  const chartCode = fs.readFileSync(
+    path.join(rootDir, 'admin/arco-design-pro-vite/src/views/dashboard/workplace/components/content-chart.vue'),
+    'utf-8'
+  );
+
+  const statsStart = repoCode.indexOf('async getDashboardStats(');
+  const statsBlock = repoCode.slice(statsStart, statsStart + 3600);
+
+  describe('1. 服务端 getDashboardStats 必须来自真实聚合', () => {
+    it('不得再返回硬编码假指标', () => {
+      expect(statsStart).toBeGreaterThan(-1);
+      expect(statsBlock).not.toContain('todayGmv: 58920');
+      expect(statsBlock).not.toContain('activeUsers: 1250');
+      expect(statsBlock).not.toContain("date: '09-22'");
+      expect(statsBlock).not.toContain('{ name: \'同城陪吃\', value: 42 }');
+    });
+
+    it('必须基于订单表实时聚合今日 GMV / 走势 / 品类', () => {
+      expect(statsBlock).toContain('DATE(created_at) = CURDATE()');
+      expect(statsBlock).toContain('GROUP BY track');
+      expect(statsBlock).toContain('DATE_SUB(CURDATE(), INTERVAL 6 DAY)');
+      expect(statsBlock).toContain('recentGmvTrend');
+    });
+
+    it('接单中大神数量来自真实计数', () => {
+      expect(statsBlock).toContain('FROM companions WHERE status = "接单中"');
+    });
+  });
+
+  describe('2. 前端走势图不得以假数据兜底', () => {
+    it('移除硬编码走势并暴露失败', () => {
+      expect(chartCode).toContain('const loadFailed = ref(false)');
+      expect(chartCode).not.toContain('09-22');
+      expect(chartCode).not.toContain('58920');
+      expect(chartCode).not.toContain('// fallback');
+    });
+  });
+});

server/tests/identity-binding-hardening.spec.ts

@@ -0,0 +1,84 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第六批回归闸门：评价下架鉴权 / 大神资料越权 / 剩余写接口身份绑定
+ */
+describe('第六批安全加固闸门 (评价下架鉴权 / 大神资料越权 / 身份绑定)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
+  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
+  const apiPath = path.join(rootDir, 'pwuniapp/common/api.js');
+
+  const indexCode = fs.readFileSync(serverIndexPath, 'utf-8');
+  const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
+  const apiCode = fs.readFileSync(apiPath, 'utf-8');
+
+  describe('1. 评价违规下架仅管理员可执行', () => {
+    it('DELETE /api/reviews/:id 必须挂载 requireAdmin', () => {
+      expect(indexCode).toContain("app.delete('/api/reviews/:id', requireAdmin");
+    });
+  });
+
+  describe('2. 大神资料/接单状态越权修改', () => {
+    it('仓储层必须提供 getCompanionOwnership 解析归属', () => {
+      expect(repoCode).toContain('async getCompanionOwnership(');
+      const start = repoCode.indexOf('async getCompanionOwnership(');
+      const block = repoCode.slice(start, start + 600);
+      expect(block).toContain('ownerUserId');
+      expect(block).toContain('comp.user_id');
+    });
+
+    it('服务端必须提供 assertCompanionActor 且生产环境要求已绑定 user_id', () => {
+      const start = indexCode.indexOf('function assertCompanionActor(');
+      expect(start).toBeGreaterThan(-1);
+      const block = indexCode.slice(start, start + 1000);
+      expect(block).toContain('isVerifiedAdminRequest(req)');
+      expect(block).toContain('IS_PRODUCTION');
+      expect(block).toContain('ownerUserId');
+      expect(block).toContain('无权');
+    });
+
+    it('两个大神资料更新路由都必须先做归属校验', () => {
+      for (const marker of ["app.put('/api/companions/:id',", "app.put('/api/companions/:id/profile',"]) {
+        const start = indexCode.indexOf(marker);
+        expect(start).toBeGreaterThan(-1);
+        const block = indexCode.slice(start, start + 600);
+        expect(block).toContain('repo.getCompanionOwnership(companionId)');
+        expect(block).toContain("assertCompanionActor(req, own, '修改大神资料')");
+      }
+    });
+  });
+
+  describe('3. 剩余写接口身份以服务端会话为准', () => {
+    it('点赞/评论/举报/收藏/分销/入驻均必须经 resolveSecureUserId 绑定身份', () => {
+      const expected = [
+        "'点赞动态'",
+        "'发表评论'",
+        "'提交举报'",
+        "'收藏大神'",
+        "'取消收藏'",
+        "'绑定邀请码'",
+        "'申请大神入驻'",
+      ];
+      for (const tag of expected) {
+        expect(indexCode).toContain(`resolveSecureUserId(req,`);
+        expect(indexCode).toContain(tag);
+      }
+      // 旧的可伪造缺省默认值必须被移除
+      expect(indexCode).not.toContain('addFavorite(Number(userId || 1001)');
+      expect(indexCode).not.toContain('bindInviteCode(Number(userId || 1001)');
+    });
+  });
+
+  describe('4. 小程序端写接口携带真实身份', () => {
+    it('评论/举报/入驻/大神资料/上车处置均注入当前用户身份', () => {
+      expect(apiCode).toContain('userId: normalizeUserId(commentData.userId)');
+      expect(apiCode).toContain('reporterId: normalizeUserId(payload.reporterId || payload.userId)');
+      expect(apiCode).toContain('userId: normalizeUserId(data && data.userId)');
+      expect(apiCode).toContain('userId: normalizeUserId(profileData.userId)');
+      expect(apiCode).toContain('{ status, userId: normalizeUserId() }');
+    });
+  });
+});

server/tests/identity-hardening.spec.ts

@@ -0,0 +1,152 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+import { signUserToken, verifyUserToken } from '../src/core/security/user-token';
+
+/**
+ * 第四批高危项回归闸门：客户端伪造身份的资金写接口收口 / 订单支付状态机收口 / 静默吞错可观测化
+ * 以「源码契约断言 + 行为断言」锁定边界，防止后续重构悄然后退。
+ */
+describe('第四批安全加固闸门 (用户会话身份 / 订单支付 / 上车申请越权 / 静默吞错)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
+  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
+  const userTokenPath = path.join(rootDir, 'server/src/core/security/user-token.ts');
+  const requestPath = path.join(rootDir, 'pwuniapp/common/request.js');
+  const loginPath = path.join(rootDir, 'pwuniapp/pages/auth/login.vue');
+
+  const indexCode = fs.readFileSync(serverIndexPath, 'utf-8');
+  const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
+  const tokenCode = fs.readFileSync(userTokenPath, 'utf-8');
+
+  describe('1. 用户会话 token 基础设施 (HMAC 签名，防止伪造他人 userId)', () => {
+    it('必须提供签名/验签与安全取用用户身份的能力', () => {
+      expect(indexCode).toContain('const USER_TOKEN_SECRET');
+      expect(indexCode).toContain('function signUserToken(');
+      expect(indexCode).toContain('function verifyUserToken(');
+      expect(indexCode).toContain('function resolveSecureUserId(');
+      expect(indexCode).toContain('function resolveRequestUserId(');
+    });
+
+    it('token 验签必须使用恒定时间比较且校验有效期', () => {
+      expect(tokenCode).toContain('crypto.timingSafeEqual');
+      expect(tokenCode).toContain('ttlMs');
+      expect(indexCode).toContain('USER_TOKEN_TTL_MS');
+    });
+
+    it('签名 token 可被正确验签并解析出用户ID', () => {
+      const SECRET = 'unit-test-secret';
+      const TTL = 7 * 24 * 3600 * 1000;
+      const token = signUserToken(8888, SECRET, TTL);
+      expect(verifyUserToken(token, SECRET, TTL)).toBe(8888);
+    });
+
+    it('篡改 payload/签名或使用错误密钥的 token 必须验签失败', () => {
+      const SECRET = 'unit-test-secret';
+      const TTL = 7 * 24 * 3600 * 1000;
+      const token = signUserToken(1001, SECRET, TTL);
+      const [payload, sig] = token.split('.');
+
+      const forgedPayload = Buffer.from(JSON.stringify({ uid: 1, ts: Date.now() })).toString('base64url');
+      expect(verifyUserToken(`${forgedPayload}.${sig}`, SECRET, TTL)).toBeNull();
+      expect(verifyUserToken(`${payload}.deadbeef`, SECRET, TTL)).toBeNull();
+      expect(verifyUserToken(token, 'wrong-secret', TTL)).toBeNull();
+      expect(verifyUserToken('not-a-token', SECRET, TTL)).toBeNull();
+    });
+
+    it('过期 token 必须验签失败', () => {
+      const SECRET = 'unit-test-secret';
+      const TTL = 1000;
+      const issuedAt = Date.now() - 10_000;
+      const token = signUserToken(2002, SECRET, TTL, issuedAt);
+      expect(verifyUserToken(token, SECRET, TTL, issuedAt + 500)).toBe(2002);
+      expect(verifyUserToken(token, SECRET, TTL, issuedAt + 10_000)).toBeNull();
+    });
+
+    it('生产环境缺失有效 token 时必须拒绝敏感操作 (fail closed)', () => {
+      const start = indexCode.indexOf('function resolveSecureUserId(');
+      expect(start).toBeGreaterThan(-1);
+      const block = indexCode.slice(start, start + 900);
+      expect(block).toContain('IS_PRODUCTION');
+      expect(block).toContain('401');
+      expect(block).toContain('无权以他人身份');
+    });
+
+    it('微信手机号登录必须签发真实签名 token，杜绝假 token', () => {
+      expect(indexCode).toContain('token: signUserToken(user.id)');
+      expect(indexCode).toContain('userToken: signUserToken(user.id)');
+      expect(indexCode).not.toContain('token: `token_${user.id}_${Date.now()}`');
+    });
+  });
+
+  describe('2. 订单支付状态机收口', () => {
+    it('非 LIVE 沙箱入账必须受 ALLOW_SANDBOX_PAY 生产闸门约束', () => {
+      const start = indexCode.indexOf("app.post('/api/orders/:id/pay'");
+      expect(start).toBeGreaterThan(-1);
+      const block = indexCode.slice(start, start + 1400);
+      expect(block).toContain('if (!ALLOW_SANDBOX_PAY)');
+      expect(block).toContain('禁止直接变更订单支付状态');
+    });
+
+    it('沙箱仅允许推进到合法已支付状态，严禁客户端任意指定终态', () => {
+      const start = indexCode.indexOf("app.post('/api/orders/:id/pay'");
+      const block = indexCode.slice(start, start + 1400);
+      expect(block).toContain("const allowedSandboxStatuses = ['履约中', '待接单']");
+      expect(block).toContain('allowedSandboxStatuses.includes(requested)');
+    });
+  });
+
+  describe('3. 提现接口以服务端会话身份为准', () => {
+    it('提现用户身份必须经 resolveSecureUserId 校验，禁止直接信任路径参数', () => {
+      const start = indexCode.indexOf("app.post('/api/users/:id/withdraw'");
+      expect(start).toBeGreaterThan(-1);
+      const block = indexCode.slice(start, start + 900);
+      expect(block).toContain("resolveSecureUserId(req, pathUserId, '申请提现')");
+      expect(block).not.toContain('const userId = Number(req.params.id);');
+    });
+  });
+
+  describe('4. 上车申请仅动态发布者本人可处置', () => {
+    it('处置路由必须校验申请归属并区分管理员', () => {
+      const start = indexCode.indexOf("app.post('/api/post-applies/:id/handle'");
+      expect(start).toBeGreaterThan(-1);
+      const block = indexCode.slice(start, start + 1500);
+      expect(block).toContain('repo.getPostApplyById(applyId)');
+      expect(block).toContain('isVerifiedAdminRequest(req)');
+      expect(block).toContain('仅动态发布者本人可处置该上车申请');
+      expect(block).toContain('SELECT user_id FROM posts WHERE id = ?');
+    });
+
+    it('handlePostApply 必须仅允许待处理申请被处置一次', () => {
+      const start = repoCode.indexOf('async handlePostApply(');
+      expect(start).toBeGreaterThan(-1);
+      const block = repoCode.slice(start, start + 900);
+      expect(block).toContain("WHERE id = ? AND status = 'PENDING'");
+      expect(block).toContain('已处置');
+    });
+  });
+
+  describe('5. 资金/结算静默吞错可观测化', () => {
+    it('服务端必须提供统一错误日志并用于支付与结算关键路径', () => {
+      expect(indexCode).toContain('function logServerError(');
+      expect(indexCode).toContain("logServerError('confirmWechatPayment.query'");
+      expect(indexCode).toContain("logServerError('resolveWechatPayRuntimeConfig'");
+      expect(repoCode).toContain('function logServerError(');
+      expect(repoCode).toContain("logServerError('handleArbitration.settle'");
+    });
+  });
+
+  describe('6. 小程序端会话 token 存储与透传', () => {
+    it('统一请求层必须携带 Authorization Bearer 用户会话 token', () => {
+      const code = fs.readFileSync(requestPath, 'utf-8');
+      expect(code).toContain("uni.getStorageSync('userToken')");
+      expect(code).toContain('Authorization: `Bearer ${sessionToken}`');
+    });
+
+    it('微信手机号登录成功后必须落地 userToken', () => {
+      const code = fs.readFileSync(loginPath, 'utf-8');
+      expect(code).toContain("res.userToken || res.token");
+      expect(code).toContain("uni.setStorageSync('userToken', sessionToken)");
+    });
+  });
+});

server/tests/order-activity-integrity.spec.ts

@@ -0,0 +1,93 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第二批高危项回归闸门：报名超卖 / 抢单竞态 / 评价绕过结算
+ * 以「源码契约断言」方式锁定关键并发与校验模式，防止后续重构悄悄回退。
+ */
+describe('订单与活动资金一致性护栏 (报名超卖 / 抢单 CAS / 评价结算绕过)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
+  const serverMysqlPath = path.join(rootDir, 'server/src/db/mysql.ts');
+  const pwuniappOrderListPath = path.join(rootDir, 'pwuniapp/pages/order/list.vue');
+
+  describe('1. 活动报名必须使用事务 + 行锁，杜绝超卖', () => {
+    it('joinActivity 必须在事务内对活动行加锁，并以当前读统计名额', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain('async joinActivity(');
+      expect(code).toContain('FROM activities WHERE id = ? FOR UPDATE');
+      expect(code).toContain('SELECT id, user_id, verify_code FROM participants WHERE activity_id = ? FOR UPDATE');
+      expect(code).toContain('活动报名人数已满');
+    });
+
+    it('joinActivity 必须防重复报名并生成活动内唯一核销码', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain('用户已报名该活动');
+      expect(code).toContain('const usedCodes = new Set(rowsList.map((r: any) => String(r.verify_code)));');
+    });
+
+    it('数据库层必须为 participants 增加 (activity_id,user_id) 与 (activity_id,verify_code) 唯一约束', () => {
+      const mysql = fs.readFileSync(serverMysqlPath, 'utf-8');
+      expect(mysql).toContain('UNIQUE KEY uq_activity_user (activity_id, user_id)');
+      expect(mysql).toContain('UNIQUE KEY uq_activity_verify (activity_id, verify_code)');
+      expect(mysql).toContain('ALTER TABLE participants ADD UNIQUE KEY uq_activity_user (activity_id, user_id)');
+      expect(mysql).toContain('ALTER TABLE participants ADD UNIQUE KEY uq_activity_verify (activity_id, verify_code)');
+    });
+  });
+
+  describe('2. 抢单必须以 claimed_by 原子 CAS 保证唯一赢家', () => {
+    it('claimOrder 必须使用 claimed_by 条件更新并校验受影响行数', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain('async claimOrder(');
+      expect(code).toContain('claimed_by = ?, claimed_at = NOW()');
+      expect(code).toContain('AND (claimed_by IS NULL OR claimed_by = ?)');
+      expect(code).toContain('res.affectedRows !== 1');
+      expect(code).toContain('该订单已被其他大神抢先接单');
+    });
+
+    it('claimOrder 必须拦截不可接单状态', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain("const blocked = ['待付款', '待支付', '已完成', '已取消', '已关闭', '已退款', '已全额退款', '争议仲裁中']");
+    });
+
+    it('数据库层必须为 orders 增加 claimed_by / claimed_at 认领标记列', () => {
+      const mysql = fs.readFileSync(serverMysqlPath, 'utf-8');
+      expect(mysql).toContain('ALTER TABLE orders ADD COLUMN claimed_by INT NULL AFTER expert_id');
+      expect(mysql).toContain('ALTER TABLE orders ADD COLUMN claimed_at DATETIME NULL AFTER claimed_by');
+    });
+  });
+
+  describe('3. 完单结算必须原子且幂等，杜绝重复结算', () => {
+    it('completeOrderWithSettlement 必须在事务内锁定订单并再次校验幂等键', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain('async completeOrderWithSettlement(');
+      expect(code).toContain('FROM orders WHERE id = ? OR order_no = ? FOR UPDATE');
+      expect(code).toContain("related_id = ? AND type = '大神完单收益结算'");
+      expect(code).toContain('await conn.commit();');
+      expect(code).toContain('await conn.rollback();');
+    });
+  });
+
+  describe('4. 订单评价必须服务端校验身份/状态/防重，杜绝绕过结算', () => {
+    it('createOrderReview 必须校验买家身份、可评价状态与防重复评价', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain('async createOrderReview(');
+      expect(code).toContain('仅下单买家本人可以评价该订单');
+      expect(code).toContain('不可评价');
+      expect(code).toContain('该订单已评价，请勿重复提交');
+      expect(code).toContain("const reviewable = ['履约中', '服务中', '已到场核销', '待确认', '已完成']");
+    });
+
+    it('同一订单仅允许一条评价的数据库唯一约束必须存在', () => {
+      const mysql = fs.readFileSync(serverMysqlPath, 'utf-8');
+      expect(mysql).toContain('UNIQUE KEY uq_order_review (order_id)');
+      expect(mysql).toContain('ALTER TABLE order_reviews ADD UNIQUE KEY uq_order_review (order_id)');
+    });
+
+    it('小程序评价必须提交真实登录用户ID，严禁硬编码 1001 绕过买家校验', () => {
+      const vue = fs.readFileSync(pwuniappOrderListPath, 'utf-8');
+      expect(vue).toContain("userId: Number(uni.getStorageSync('userId') || 1001),");
+    });
+  });
+});

server/tests/order-lifecycle-hardening.spec.ts

@@ -0,0 +1,133 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第五批高危项回归闸门：订单生命周期越权 / 结算状态闸门 / 组局核销改价身份
+ * 以「源码契约断言」锁定边界，防止后续重构悄然后退。
+ */
+describe('第五批安全加固闸门 (订单越权结算 / 订单身份收口 / 组局核销改价)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
+  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
+  const apiPath = path.join(rootDir, 'pwuniapp/common/api.js');
+
+  const indexCode = fs.readFileSync(serverIndexPath, 'utf-8');
+  const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
+  const apiCode = fs.readFileSync(apiPath, 'utf-8');
+
+  const routeBlock = (marker: string, len = 1600) => {
+    const start = indexCode.indexOf(marker);
+    expect(start).toBeGreaterThan(-1);
+    return indexCode.slice(start, start + len);
+  };
+
+  describe('1. 结算状态闸门 (防前端直接结算套现)', () => {
+    it('completeOrderWithSettlement 必须拒绝未支付/未接单/已退款等状态结算', () => {
+      const start = repoCode.indexOf('async completeOrderWithSettlement(');
+      expect(start).toBeGreaterThan(-1);
+      const block = repoCode.slice(start, start + 1600);
+      expect(block).toContain("const settleBlocked = ['待支付', '待接单', '已取消', '已退款', '已全额退款']");
+      expect(block).toContain('settleBlocked.includes(String(order.status))');
+      expect(block).toContain('不可结算');
+      expect(block).toContain('e.status = 409');
+    });
+  });
+
+  describe('2. 订单归属解析与操作者角色', () => {
+    it('必须提供 getOrderOwnership 并采用大神身份并集策略', () => {
+      expect(repoCode).toContain('async getOrderOwnership(');
+      const start = repoCode.indexOf('async getOrderOwnership(');
+      const block = repoCode.slice(start, start + 1200);
+      expect(block).toContain('LEFT JOIN companions c ON c.id = o.expert_id');
+      expect(block).toContain('companionIds');
+      expect(block).toContain('claimedBy');
+    });
+
+    it('resolveOrderActor 必须区分管理员/买家/承接大神', () => {
+      const start = indexCode.indexOf('function resolveOrderActor(');
+      expect(start).toBeGreaterThan(-1);
+      const block = indexCode.slice(start, start + 900);
+      expect(block).toContain('isVerifiedAdminRequest(req)');
+      expect(block).toContain('isBuyer');
+      expect(block).toContain('companionIds.includes(callerId)');
+    });
+  });
+
+  describe('3. 订单生命周期写接口身份收口', () => {
+    it('确认完成订单仅交易双方或管理员可操作', () => {
+      const block = routeBlock("app.post('/api/orders/:id/complete'");
+      expect(block).toContain("resolveOrderActor(req, own, '确认完成订单')");
+      expect(block).toContain('仅交易双方或平台管理员可完成该订单');
+    });
+
+    it('取消订单仅买家本人或管理员可操作', () => {
+      const block = routeBlock("app.post('/api/orders/:id/cancel'");
+      expect(block).toContain("resolveOrderActor(req, own, '取消订单')");
+      expect(block).toContain('仅买家本人或平台管理员可取消该订单');
+    });
+
+    it('拒单仅承接大神本人或管理员可操作', () => {
+      const block = routeBlock("app.post('/api/orders/:id/reject'");
+      expect(block).toContain("resolveOrderActor(req, own, '拒单')");
+      expect(block).toContain('仅承接大神本人或平台管理员可拒单');
+    });
+
+    it('申请完成服务仅承接大神本人或管理员可操作', () => {
+      const block = routeBlock("app.post('/api/orders/:id/apply-complete'");
+      expect(block).toContain("resolveOrderActor(req, own, '申请完成服务')");
+      expect(block).toContain('仅承接大神本人或平台管理员可申请完成服务');
+    });
+
+    it('退款申诉仅买家本人或管理员可发起', () => {
+      const block = routeBlock("app.post('/api/orders/:id/refund'");
+      expect(block).toContain("resolveOrderActor(req, own, '发起退款申诉')");
+      expect(block).toContain('仅买家本人或平台管理员可发起退款申诉');
+    });
+
+    it('创建订单必须绑定服务端解析的买家身份', () => {
+      const block = routeBlock("app.post('/api/orders',");
+      expect(block).toContain("'创建订单'");
+      expect(block).toContain('buyerId');
+    });
+  });
+
+  describe('4. 组局核销/改价身份以服务端会话为准', () => {
+    it('核销、改价、通用核销必须经 resolveSecureUserId 解析操作人', () => {
+      expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '核销组局门票')");
+      expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '调整组局出价')");
+      expect(indexCode).toContain("resolveSecureUserId(req, Number(operatorId || 0), '核销门票')");
+      expect(indexCode).not.toContain('Number(operatorId || 1001)');
+    });
+
+    it('报名/退席必须绑定服务端解析的用户身份', () => {
+      expect(indexCode).toContain("resolveSecureUserId(req, Number(userId || req.headers['x-user-id'] || 2008), '报名参加活动')");
+      expect(indexCode).toContain("resolveSecureUserId(req, Number(userId), '退出组局')");
+    });
+
+    it('修改个人资料必须绑定服务端解析的用户身份', () => {
+      expect(indexCode).toContain("resolveSecureUserId(req, Number(req.params.id), '修改个人资料')");
+    });
+  });
+
+  describe('5. 小程序端写接口携带真实身份', () => {
+    it('订单生命周期接口必须携带 normalizeUserId 解析出的 userId', () => {
+      const block = (marker: string, len = 420) => {
+        const start = apiCode.indexOf(marker);
+        expect(start).toBeGreaterThan(-1);
+        return apiCode.slice(start, start + len);
+      };
+      expect(block('export async function cancelOrder(')).toContain('{ userId: normalizeUserId() }');
+      expect(block('export async function completeOrder(')).toContain('{ userId: normalizeUserId() }');
+      expect(block('export async function rejectOrder(')).toContain('userId: normalizeUserId(payload.userId)');
+      expect(block('export async function applyCompleteOrder(')).toContain('userId: normalizeUserId(payload.userId)');
+      expect(block('export async function refundOrder(')).toContain('userId: normalizeUserId(data.userId)');
+    });
+
+    it('下单必须携带买家身份，核销/改价必须携带操作人身份', () => {
+      expect(apiCode).toContain('buyerId: uid');
+      expect(apiCode).toContain('operatorId: normalizeUserId(operatorId)');
+      expect(apiCode).not.toContain('operatorId = 1001');
+    });
+  });
+});

server/tests/ownership-hardening.spec.ts

@@ -0,0 +1,74 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+
+/**
+ * 第七批回归闸门：评价回复归属 / 服务上下架归属 / 通用核销归属
+ * 以「源码契约断言」锁定安全边界。
+ */
+describe('第七批安全加固闸门 (评价回复 / 服务上下架 / 通用核销归属)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
+  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
+  const apiPath = path.join(rootDir, 'pwuniapp/common/api.js');
+
+  const indexCode = fs.readFileSync(serverIndexPath, 'utf-8');
+  const repoCode = fs.readFileSync(serverRepoPath, 'utf-8');
+  const apiCode = fs.readFileSync(apiPath, 'utf-8');
+
+  const routeBlock = (marker: string, len = 1400) => {
+    const start = indexCode.indexOf(marker);
+    expect(start).toBeGreaterThan(-1);
+    return indexCode.slice(start, start + len);
+  };
+
+  describe('1. 评价回复越权', () => {
+    it('仓储层必须提供 getReviewOwnership (基于 order_reviews.expert_id)', () => {
+      expect(repoCode).toContain('async getReviewOwnership(');
+      const start = repoCode.indexOf('async getReviewOwnership(');
+      const block = repoCode.slice(start, start + 400);
+      expect(block).toContain('SELECT expert_id FROM order_reviews');
+      expect(block).toContain('getCompanionOwnership');
+    });
+
+    it('回复路由必须校验归属', () => {
+      const block = routeBlock("app.post('/api/reviews/:id/reply'");
+      expect(block).toContain('repo.getReviewOwnership(reviewId)');
+      expect(block).toContain("assertCompanionActor(req, own, '回复评价')");
+    });
+  });
+
+  describe('2. 服务上下架越权', () => {
+    it('仓储层必须提供 getExpertServiceOwnership (基于 expert_services.expert_id)', () => {
+      expect(repoCode).toContain('async getExpertServiceOwnership(');
+      const start = repoCode.indexOf('async getExpertServiceOwnership(');
+      const block = repoCode.slice(start, start + 800);
+      expect(block).toContain('SELECT expert_id FROM expert_services');
+      expect(block).toContain('getCompanionOwnership');
+    });
+
+    it('上下架路由必须校验归属', () => {
+      const block = routeBlock("app.put('/api/companions/:id/services/:serviceId/status'");
+      expect(block).toContain('repo.getExpertServiceOwnership(serviceId)');
+      expect(block).toContain("assertCompanionActor(req, own, '调整服务上下架')");
+    });
+  });
+
+  describe('3. 通用核销归属 (生产闸门)', () => {
+    it('生产环境必须校验核销人：活动=发起人，订单=承接大神', () => {
+      const block = routeBlock("app.post('/api/verify/universal'");
+      expect(block).toContain('IS_PRODUCTION && !isVerifiedAdminRequest(req)');
+      expect(block).toContain("info.type === 'ACTIVITY'");
+      expect(block).toContain('Number(info.creatorId) === operator');
+      expect(block).toContain('own!.companionIds.includes(operator)');
+      expect(block).toContain('无权核销该门票');
+    });
+  });
+
+  describe('4. 小程序端写接口携带真实身份', () => {
+    it('回复评价/切换服务状态必须携带当前用户身份', () => {
+      expect(apiCode).toContain('{ replyContent, userId: normalizeUserId() }');
+      expect(apiCode).toContain('{ status, userId: normalizeUserId() }');
+    });
+  });
+});

server/tests/rbac-permission.spec.ts

@@ -708,5 +708,18 @@ describe('RBAC Permission Architecture (TDD 全流程多角色权限与越权防
         expect(content).toContain('/pages/user/index');
       }
     });
+
+    it('大神端冷启动或刷新进入小程序首页时，首页与 App.vue 必须自动路由至大神接单大厅', () => {
+      const indexPath = path.resolve(__dirname, '../../pwuniapp/pages/index/index.vue');
+      const indexContent = fs.readFileSync(indexPath, 'utf-8');
+      expect(indexContent).toContain('checkExpertRedirect');
+      expect(indexContent).toContain('/pages/expert/hall');
+      expect(indexContent).toContain('ROLE_TYPES.EXPERT');
+
+      const appPath = path.resolve(__dirname, '../../pwuniapp/App.vue');
+      const appContent = fs.readFileSync(appPath, 'utf-8');
+      expect(appContent).toContain('/pages/expert/hall');
+      expect(appContent).toContain('ROLE_TYPES.EXPERT');
+    });
   });
 });

server/tests/security-hardening.spec.ts

@@ -0,0 +1,116 @@
+// 已读取AGENTS.md
+import * as fs from 'fs';
+import * as path from 'path';
+import { ContentSecurityService } from '../src/core/security/content-security.service';
+
+/**
+ * 第三批高危项回归闸门：友圈动态越权删除 / 组局解散提权 / 微信内容安全真实对接
+ * 以「源码契约断言 + 服务行为断言」锁定安全边界，防止后续重构悄然后退。
+ */
+describe('第三批安全加固闸门 (动态越权删除 / 组局解散提权 / 真实微信内容安全)', () => {
+  const rootDir = path.resolve(__dirname, '../../');
+  const serverRepoPath = path.join(rootDir, 'server/src/db/repository.ts');
+  const serverIndexPath = path.join(rootDir, 'server/src/index.ts');
+  const secServicePath = path.join(rootDir, 'server/src/core/security/content-security.service.ts');
+  const pwuniappApiPath = path.join(rootDir, 'pwuniapp/common/api.js');
+
+  describe('1. 友圈动态仅作者本人可删除', () => {
+    it('deletePost 必须校验作者归属并拒绝越权删除', () => {
+      const code = fs.readFileSync(serverRepoPath, 'utf-8');
+      expect(code).toContain('async deletePost(');
+      expect(code).toContain('无权删除他人发布的动态');
+      expect(code).toContain('SELECT id, user_id FROM posts WHERE id = ? LIMIT 1');
+      expect(code).toContain('DELETE FROM posts WHERE id = ? AND user_id = ?');
+    });
+
+    it('删除路由必须要求显式身份，不得默认 1001', () => {
+      const code = fs.readFileSync(serverIndexPath, 'utf-8');
+      const start = code.indexOf("app.delete('/api/posts/:id'");
+      expect(start).toBeGreaterThan(-1);
+      const block = code.slice(start, start + 700);
+      expect(block).toContain("req.query.userId || req.body?.userId || req.headers['x-user-id'] || 0");
+      expect(block).toContain('await assertUserNotBanned(uid');
+      expect(block).not.toContain('|| 1001)');
+    });
+
+    it('小程序删除动态必须携带真实登录用户ID', () => {
+      const code = fs.readFileSync(pwuniappApiPath, 'utf-8');
+      const start = code.indexOf('export async function deletePost(');
+      expect(start).toBeGreaterThan(-1);
+      const block = code.slice(start, start + 400);
+      expect(block).toContain("uni.getStorageSync('userId') || 1001");
+      expect(block).not.toContain('userId = 1001');
+    });
+  });
+
+  describe('2. 组局解散的管理员特权必须来自服务端签名 token', () => {
+    it('cancel 路由严禁信任客户端 operatorRole / x-user-role 提权', () => {
+      const code = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(code).toContain('function isVerifiedAdminRequest(');
+      const start = code.indexOf("app.post('/api/activities/:id/cancel'");
+      expect(start).toBeGreaterThan(-1);
+      const block = code.slice(start, start + 900);
+      expect(block).toContain('isVerifiedAdminRequest(req)');
+      expect(block).not.toContain("operatorRole === 'admin'");
+      expect(block).not.toContain("req.headers['x-user-role']");
+    });
+  });
+
+  describe('3. 内容安全真实对接微信 msgSecCheck', () => {
+    it('服务必须提供可注入的远端真实审核器与异步检测方法', () => {
+      const code = fs.readFileSync(secServicePath, 'utf-8');
+      expect(code).toContain('setRemoteChecker');
+      expect(code).toContain('checkTextAsync');
+      expect(code).toContain('RemoteTextChecker');
+    });
+
+    it('index.ts 必须注册微信 msg_sec_check 真实调用并接入关键 UGC 路由', () => {
+      const code = fs.readFileSync(serverIndexPath, 'utf-8');
+      expect(code).toContain('contentSecurityService.setRemoteChecker');
+      expect(code).toContain('https://api.weixin.qq.com/wxa/msg_sec_check');
+      expect(code).toContain('version: 2');
+      expect(code).toContain('await contentSecurityService.checkTextAsync(');
+    });
+
+    it('checkTextAsync 在无远端审核器时降级本地词库：命中拦截、合规放行', async () => {
+      const svc = new ContentSecurityService();
+      const hit = await svc.checkTextAsync('同城美女上门特殊服务');
+      expect(hit.pass).toBe(false);
+      expect(hit.code).toBe(87014);
+      expect(hit.suggest).toBe('block');
+      const ok = await svc.checkTextAsync('今晚一起打王者荣耀五排，辅助位缺一');
+      expect(ok.pass).toBe(true);
+      expect(ok.code).toBe(0);
+    });
+
+    it('注入的远端审核器会被调用，risky 内容应被二次拦截', async () => {
+      const svc = new ContentSecurityService();
+      let called = 0;
+      svc.setRemoteChecker(async (text) => {
+        called += 1;
+        if (text.includes('远端拦截')) {
+          return { pass: false, code: 87014, label: 'WECHAT_RISKY', suggest: 'block' as const, message: '内容涉嫌违规，已被微信内容安全系统拦截' };
+        }
+        return null;
+      });
+      expect(svc.hasRemoteChecker()).toBe(true);
+
+      const risky = await svc.checkTextAsync('这条内容需要远端拦截处理');
+      expect(called).toBe(1);
+      expect(risky.pass).toBe(false);
+      expect(risky.label).toBe('WECHAT_RISKY');
+
+      const normal = await svc.checkTextAsync('正常合规文本内容');
+      expect(normal.pass).toBe(true);
+    });
+
+    it('远端审核器抛异常时必须 fail-open 降级本地，避免误杀正常内容', async () => {
+      const svc = new ContentSecurityService();
+      svc.setRemoteChecker(async () => {
+        throw new Error('wechat api down');
+      });
+      const r = await svc.checkTextAsync('今晚一起打王者荣耀五排');
+      expect(r.pass).toBe(true);
+    });
+  });
+});

server/tests/wechat-pay-v3.spec.ts

@@ -0,0 +1,212 @@
+import crypto from 'crypto';
+import {
+  buildAuthorization,
+  buildJsapiPayParams,
+  verifyNotifySignature,
+  decryptNotifyResource,
+  resolvePlatformKey,
+  WechatPayConfig,
+} from '../src/core/pay/wechat-pay-v3';
+
+/**
+ * 微信支付 V3 加密管道行为测试
+ * 通过内存生成 RSA 密钥对，离线验证：请求签名 / 回调验签 / APIv3 解密 / 小程序支付参数签名。
+ * 这些是「真实收款对账」的安全基石，必须可被公钥验证且篡改必然失败。
+ */
+describe('WechatPayV3 (支付加密管道)', () => {
+  let merchantPriv: string;
+  let merchantPub: string;
+  let platformPriv: string;
+  let platformPub: string;
+  let cfg: WechatPayConfig;
+
+  beforeAll(() => {
+    const merchant = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
+    merchantPriv = merchant.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+    merchantPub = merchant.publicKey.export({ type: 'spki', format: 'pem' }).toString();
+
+    const platform = crypto.generateKeyPairSync('rsa', { modulusLength: 2048 });
+    platformPriv = platform.privateKey.export({ type: 'pkcs8', format: 'pem' }).toString();
+    platformPub = platform.publicKey.export({ type: 'spki', format: 'pem' }).toString();
+
+    cfg = {
+      appId: 'wx_test_app',
+      mchId: '1600000000',
+      apiV3Key: 'A'.repeat(32),
+      serialNo: 'MERCHANTSERIAL001',
+      privateKey: merchantPriv,
+    };
+  });
+
+  describe('1. 商户请求签名 (buildAuthorization)', () => {
+    it('生成的 Authorization 头包含 mchid/序列号 且签名可被商户公钥验证', () => {
+      const body = JSON.stringify({ appid: cfg.appId, out_trade_no: 'TEST_1' });
+      const auth = buildAuthorization({
+        method: 'POST',
+        urlPath: '/v3/pay/transactions/jsapi',
+        body,
+        cfg,
+      });
+      const m = auth.match(
+        /mchid="([^"]+)",nonce_str="([^"]+)",signature="([^"]+)",timestamp="([^"]+)",serial_no="([^"]+)"/
+      );
+      expect(m).not.toBeNull();
+      expect(m![1]).toBe(cfg.mchId);
+      expect(m![5]).toBe(cfg.serialNo);
+
+      const message = `POST\n/v3/pay/transactions/jsapi\n${m![4]}\n${m![2]}\n${body}\n`;
+      const ok = crypto
+        .createVerify('RSA-SHA256')
+        .update(message)
+        .verify(merchantPub, m![3], 'base64');
+      expect(ok).toBe(true);
+    });
+
+    it('报文体被篡改后验签必然失败', () => {
+      const body = JSON.stringify({ out_trade_no: 'TEST_1' });
+      const auth = buildAuthorization({
+        method: 'POST',
+        urlPath: '/v3/pay/transactions/jsapi',
+        body,
+        cfg,
+      });
+      const m = auth.match(/nonce_str="([^"]+)",signature="([^"]+)",timestamp="([^"]+)"/)!;
+      const tamperedMsg = `POST\n/v3/pay/transactions/jsapi\n${m[3]}\n${m[1]}\n${JSON.stringify({ out_trade_no: 'TEST_2' })}\n`;
+      const ok = crypto
+        .createVerify('RSA-SHA256')
+        .update(tamperedMsg)
+        .verify(merchantPub, m[2], 'base64');
+      expect(ok).toBe(false);
+    });
+  });
+
+  describe('2. 回调验签 (verifyNotifySignature)', () => {
+    it('平台私钥签名 + 平台公钥验签 通过', () => {
+      const pcfg: WechatPayConfig = { ...cfg, platformPublicKey: platformPub };
+      const timestamp = String(Math.floor(Date.now() / 1000));
+      const nonce = 'nonce123456';
+      const body = JSON.stringify({ id: 'evt_1', event_type: 'TRANSACTION.SUCCESS' });
+      const signature = crypto
+        .createSign('RSA-SHA256')
+        .update(`${timestamp}\n${nonce}\n${body}\n`)
+        .sign(platformPriv, 'base64');
+
+      expect(
+        verifyNotifySignature({ cfg: pcfg, timestamp, nonce, body, signature, serial: 'P' })
+      ).toBe(true);
+    });
+
+    it('报文被篡改后验签失败', () => {
+      const pcfg: WechatPayConfig = { ...cfg, platformPublicKey: platformPub };
+      const timestamp = String(Math.floor(Date.now() / 1000));
+      const nonce = 'nonce123456';
+      const body = JSON.stringify({ id: 'evt_1' });
+      const signature = crypto
+        .createSign('RSA-SHA256')
+        .update(`${timestamp}\n${nonce}\n${body}\n`)
+        .sign(platformPriv, 'base64');
+
+      expect(
+        verifyNotifySignature({ cfg: pcfg, timestamp, nonce, body: body + 'x', signature, serial: 'P' })
+      ).toBe(false);
+    });
+
+    it('时间戳超出 5 分钟容差时验签失败 (防重放)', () => {
+      const pcfg: WechatPayConfig = { ...cfg, platformPublicKey: platformPub };
+      const timestamp = String(Math.floor(Date.now() / 1000) - 1000);
+      const nonce = 'nonce123456';
+      const body = JSON.stringify({ id: 'evt_1' });
+      const signature = crypto
+        .createSign('RSA-SHA256')
+        .update(`${timestamp}\n${nonce}\n${body}\n`)
+        .sign(platformPriv, 'base64');
+
+      expect(
+        verifyNotifySignature({ cfg: pcfg, timestamp, nonce, body, signature, serial: 'P' })
+      ).toBe(false);
+    });
+
+    it('未配置平台公钥时失败关闭 (fail-closed)', () => {
+      const timestamp = String(Math.floor(Date.now() / 1000));
+      const nonce = 'nonce123456';
+      const body = '{}';
+      const signature = 'anything';
+      expect(
+        verifyNotifySignature({ cfg, timestamp, nonce, body, signature, serial: 'P' })
+      ).toBe(false);
+    });
+  });
+
+  describe('3. APIv3 回调报文解密 (decryptNotifyResource)', () => {
+    const apiV3Key = 'abcdefghijklmnopqrstuvwxyz123456';
+    const nonce = 'randnonce12';
+    const aad = 'transaction';
+
+    const encrypt = (plain: string) => {
+      const cipher = crypto.createCipheriv(
+        'aes-256-gcm',
+        Buffer.from(apiV3Key),
+        Buffer.from(nonce)
+      );
+      cipher.setAAD(Buffer.from(aad));
+      const enc = Buffer.concat([cipher.update(plain, 'utf8'), cipher.final()]);
+      return Buffer.concat([enc, cipher.getAuthTag()]).toString('base64');
+    };
+
+    it('AES-256-GCM 解密还原原始业务报文', () => {
+      const plain = JSON.stringify({
+        out_trade_no: 'WX_RECHARGE_1',
+        trade_state: 'SUCCESS',
+        transaction_id: '42000',
+        amount: { total: 1000 },
+      });
+      const decrypted = decryptNotifyResource(apiV3Key, {
+        ciphertext: encrypt(plain),
+        nonce,
+        associated_data: aad,
+      });
+      expect(decrypted.out_trade_no).toBe('WX_RECHARGE_1');
+      expect(decrypted.trade_state).toBe('SUCCESS');
+      expect(decrypted.amount.total).toBe(1000);
+    });
+
+    it('密钥错误时解密抛错，绝不返回伪造数据', () => {
+      const plain = JSON.stringify({ out_trade_no: 'X' });
+      const ciphertext = encrypt(plain);
+      expect(() =>
+        decryptNotifyResource('z'.repeat(32), { ciphertext, nonce, associated_data: aad })
+      ).toThrow();
+    });
+
+    it('APIv3 密钥长度非 32 位时拒绝解密', () => {
+      expect(() =>
+        decryptNotifyResource('short', { ciphertext: 'AAAA', nonce, associated_data: aad })
+      ).toThrow();
+    });
+  });
+
+  describe('4. 小程序支付参数签名 (buildJsapiPayParams)', () => {
+    it('paySign 可被商户公钥验证', () => {
+      const params = buildJsapiPayParams(cfg, 'wx_test_123');
+      expect(params.signType).toBe('RSA');
+      expect(params.package).toBe('prepay_id=wx_test_123');
+      const message = `${cfg.appId}\n${params.timeStamp}\n${params.nonceStr}\n${params.package}\n`;
+      const ok = crypto
+        .createVerify('RSA-SHA256')
+        .update(message)
+        .verify(merchantPub, params.paySign, 'base64');
+      expect(ok).toBe(true);
+    });
+  });
+
+  describe('5. 平台公钥解析 (resolvePlatformKey)', () => {
+    it('合法的公钥 PEM 可解析', () => {
+      expect(resolvePlatformKey(platformPub)).not.toBeNull();
+    });
+
+    it('空值与非法内容返回 null', () => {
+      expect(resolvePlatformKey('')).toBeNull();
+      expect(resolvePlatformKey('not-a-pem')).toBeNull();
+    });
+  });
+});